Racerz

**Name of the Vulnerable Software and Affected Versions** Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 **Description** Incorrect host parsing in the `UriComponentsBuilder` component may allow applications that use it to parse and validate externally provided URL strings to be exposed to a server-side request forgery (SSRF) attack. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update Spring Framework versions 7.0.0 through 7.0.7 to a newer version. Update Spring Framework versions 6.2.0 through 6.2.18 to a newer version.

**Name of the Vulnerable Software and Affected Versions** mwielgoszewski doorman versions prior to 0.7 **Description** A flaw exists in the `is safe url` function within the `doorman/users/views.py` file. Manipulation of the `Next` argument can result in an open redirect. This issue can be exploited remotely. The exploit has been publicly disclosed. **Recommendations** Update to version 0.7 or later. As a temporary workaround, consider restricting or validating the `Next` parameter to prevent redirection to untrusted URLs.

Name of the Vulnerable Software and Affected Versions: getrebuild/rebuild version 4.0.4 Description: An issue exists in the `com.rebuild.web.RebuildWebInterceptor` class, specifically within the `preHandle` function. The code uses `CodecUtils.urlDecode(request.getRequestURI())` to decode the request path and checks if it ends with `/error`. If it does, the interceptor is skipped, otherwise, a redirect to the `/user/login` API endpoint occurs. This allows unauthenticated attackers to potentially gain sensitive information or escalate privileges. Recommendations: For getrebuild/rebuild version 4.0.4, ensure proper authentication checks are implemented before allowing access to any resources or redirecting to the `/user/login` API endpoint.

Name of the Vulnerable Software and Affected Versions: TDuckCloud tduck-platform versions prior to 5.2 Description: A critical issue exists in TDuckCloud tduck-platform prior to version 5.2 related to improper authorization. The vulnerability is located in the `preHandle` function of the `/manage/` file within the `com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor` component. This allows for remote exploitation. The exploit has been publicly disclosed. Recommendations: Update TDuckCloud tduck-platform to version 5.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions through 18.12.14 **Description** This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue. **Recommendations** Apache OFBiz versions through 18.12.14: Upgrade to version 18.12.15 to resolve the issue. As a temporary workaround, consider restricting access to unauthenticated endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.13 **Description** The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This allows a remote attacker to execute arbitrary code by injecting a specially crafted URL. The vulnerability has been exploited in real-world attacks, with one of the attackers being the Mirai botnet. The exploitation is relatively simple, involving the addition of a semicolon (;) after a public URL, followed by a private URL that the attacker wishes to access. This can bypass authentication and allow code execution on the server. **Recommendations** To resolve the issue, users are recommended to upgrade to version 18.12.13, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable API endpoints, such as `/webtools/control/forgotPassword`, to minimize the risk of exploitation. Additionally, avoid using specially crafted URLs that could be used to exploit the path traversal vulnerability.